docs: note 2026-06-04 Caddy proxy fixes (auth.hubris.network, sso, forward-auth)

infrastructure/dns.md

@@ -80,7 +80,17 @@ Either:
 
 ## Changelog
 
-### 2026-06-03 — single *authoring* source: Technitium → NetBird managed zone sync
+### 2026-06-04 — Caddy: proxy auth.hubris.network → VPS; fix stale /etc/hosts across fleet
+Authentik had migrated to the VPS on 2026-05-31, but:
+- Caddy's `auth.hubris.network` block still proxied to dead `192.168.8.6:9000`
+- Caddy's `authentik` forward-auth snippet and `sso.hubris.network` block also referenced the stale IP
+- Gitea's `/etc/hosts` had both the VPS IP and the old Caddy IP, causing Gitea to fail on OAuth2 token exchange with `404` then `issuer mismatch`
+
+**Fixed:**
+- Caddy Caddyfile: `auth.hubris.network`, `authentik` snippet, and `sso.hubris.network` all proxy to VPS (`82.165.190.79:443`) with proper Host header stripping
+- Gitea (LXC 104), Jellyfin (101), Paperless (103), Apps (105), Nextcloud (114), ElementSynapse (118), Mule-Images (120), ArrStack (122), Plato (126): /etc/hosts → `192.168.8.175` only (Caddy proxy)
+- Caddy LXC (121) /etc/hosts: self-reference removed, points to VPS
+- All stale `192.168.8.6` references eliminated from Caddyfile
 The "delete NetBird managed zone → forward everything to Technitium" plan was **abandoned** — NetBird's DNS defeats it: it **won't apply a nameserver group that contains the peer's own mesh IP** (the Mac's `100.122.234.17` → `Nameservers: 0/0 Available`), and nameserver-group forwarding to Technitium never actually took effect for mesh peers (the **managed zone was doing all the real work**; disabling it broke all mesh resolution). So the model is now:
 
 - **Technitium (`192.168.8.2`) is the single place you author DNS** (UI/API, MX/SPF/CAA, full zone).